UBUNTU-CVE-2026-58494
A vulnerability in rust-wasmtime prior to versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1 allows a WASI guest with read-only source file capability to overwrite host files exposed as read-only through certain filesystem interfaces. This occurs because the runtime checks directory permissions but not matching file permissions on source and destination preopens during hard-link creation and renaming. The issue is fixed in the specified versions.
AI Analysis
Technical Summary
The rust-wasmtime runtime for WebAssembly versions before 24.0.11, 36.0.12, 45.0.3, and 46.0.1 contains a vulnerability in the wasmtime-wasi component. The vulnerability arises because the runtime checks directory permissions but fails to verify that file permissions match between source and destination preopens when performing hard-link creation and renaming operations. This flaw allows a WASI guest with only read-only capability on a source file to overwrite host files that are exposed as read-only (FilePerms::READ) through wasip1, wasip2, or wasip3 filesystem interfaces. The vulnerability is resolved by updates to the specified fixed versions.
Potential Impact
An attacker controlling a WASI guest with read-only access to a source file can exploit this vulnerability to overwrite host files that should be read-only, potentially leading to unauthorized modification of host files. The CVSS vector indicates local attack vector with low complexity and low privileges required, no user interaction, scope changed, no confidentiality impact, high integrity impact, and no availability impact.
Mitigation Recommendations
This vulnerability is fixed in rust-wasmtime versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1. Users should upgrade to these or later versions to remediate the issue. No vendor advisory states otherwise, so patching is the recommended mitigation.
UBUNTU-CVE-2026-58494
Description
A vulnerability in rust-wasmtime prior to versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1 allows a WASI guest with read-only source file capability to overwrite host files exposed as read-only through certain filesystem interfaces. This occurs because the runtime checks directory permissions but not matching file permissions on source and destination preopens during hard-link creation and renaming. The issue is fixed in the specified versions.
CVSS v3.1
Score 6.5medium
Affected software
pkg:deb/ubuntu/[email protected]+dfsg-3?arch=source&distro=noblepkg:deb/ubuntu/[email protected]+dfsg-3?arch=source&distro=questingpkg:deb/ubuntu/[email protected]+dfsg-1?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The rust-wasmtime runtime for WebAssembly versions before 24.0.11, 36.0.12, 45.0.3, and 46.0.1 contains a vulnerability in the wasmtime-wasi component. The vulnerability arises because the runtime checks directory permissions but fails to verify that file permissions match between source and destination preopens when performing hard-link creation and renaming operations. This flaw allows a WASI guest with only read-only capability on a source file to overwrite host files that are exposed as read-only (FilePerms::READ) through wasip1, wasip2, or wasip3 filesystem interfaces. The vulnerability is resolved by updates to the specified fixed versions.
Potential Impact
An attacker controlling a WASI guest with read-only access to a source file can exploit this vulnerability to overwrite host files that should be read-only, potentially leading to unauthorized modification of host files. The CVSS vector indicates local attack vector with low complexity and low privileges required, no user interaction, scope changed, no confidentiality impact, high integrity impact, and no availability impact.
Mitigation Recommendations
This vulnerability is fixed in rust-wasmtime versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1. Users should upgrade to these or later versions to remediate the issue. No vendor advisory states otherwise, so patching is the recommended mitigation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-58494
- Osv Schema Version
- 1.7.0
- Aliases
- []
- Ecosystems
- ["Ubuntu:24.04:LTS","Ubuntu:25.10","Ubuntu:26.04:LTS"]
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a58b45d68715ace43d6be0d
Added to database: 07/16/2026, 10:37:17 UTC
Last enriched: 07/16/2026, 11:34:49 UTC
Last updated: 07/31/2026, 19:24:49 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.